Threats tagged 'ghsa-mcvv-pcqf-fqr2'

1 threat

Severity	CVSS	Threat	Source	Published	Score and star
Medium	5.1	CVE-2026-54380VitaFit cloud API before 2026-10-30 contained a stored cross-site scripting vulnerability that allows authenticated Medium5.12026-11-05GCVE DatabaseCVE-2026-54380 VitaFit cloud API versions before 2026-10-30 have a stored cross-site scripting (XSS) vulnerability. Authenticated attackers can upload SVG images containing malicious JavaScript to a shared storage bucket. The application does not properly restrict script execution or force downloads for SVG content, allowing the JavaScript to execute when a victim opens the file directly in a browser. Report on CVE-2026-54380 Vulnerability CWE-79 #ghsa-mcvv-pcqf-fqr2	GCVE Database	2026-11-05

Page 1 of 1